Replace bundled registry with user-owned Google Artifact Registry

Amp-Thread-ID: https://ampcode.com/threads/T-01a05ff5-ad1a-7058-8fbe-bc5814e87049
Co-authored-by: Arjun Komath <arjunkomath@gmail.com>

Author: ampagent

.github/workflows/release.yml

@@ -160,13 +160,12 @@ jobs:
           compose_production=$(sha256sum deployment/compose.production.yml | awk '{print $1}')
           compose_postgres=$(sha256sum deployment/compose.postgres.yml | awk '{print $1}')
           web_digest=$(cat image-digests/web)
-          registry_digest=$(cat image-digests/registry)
           updater_digest=$(cat image-digests/updater)
 
           for checksum in "$agent_amd64" "$agent_arm64" "$compose_production" "$compose_postgres"; do
             [[ "$checksum" =~ $sha256_pattern ]]
           done
-          for digest in "$web_digest" "$registry_digest" "$updater_digest"; do
+          for digest in "$web_digest" "$updater_digest"; do
             [[ "$digest" =~ $digest_pattern ]]
           done
           [[ "$RELEASE_VERSION" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]
@@ -180,7 +179,6 @@ jobs:
             --arg compose_production "$compose_production" \
             --arg compose_postgres "$compose_postgres" \
             --arg web_digest "$web_digest" \
-            --arg registry_digest "$registry_digest" \
             --arg updater_digest "$updater_digest" \
             '{
               version: $version,
@@ -195,7 +193,6 @@ jobs:
               },
               images: {
                 web: $web_digest,
-                registry: $registry_digest,
                 updater: $updater_digest
               }
             }' > binaries/release-manifest.json
@@ -331,16 +328,6 @@ jobs:
             arch: arm64
             platform: linux/arm64
             runner: blacksmith-2vcpu-ubuntu-2404-arm
-          - image: registry
-            context: registry
-            arch: amd64
-            platform: linux/amd64
-            runner: blacksmith-2vcpu-ubuntu-2404
-          - image: registry
-            context: registry
-            arch: arm64
-            platform: linux/arm64
-            runner: blacksmith-2vcpu-ubuntu-2404-arm
           - image: updater
             context: deployment/updater
             arch: amd64
@@ -397,7 +384,7 @@ jobs:
     runs-on: blacksmith-2vcpu-ubuntu-2404
     strategy:
       matrix:
-        image: [web, registry, updater]
+        image: [web, updater]
 
     steps:
       - name: Download digests

AGENTS.md

@@ -16,7 +16,7 @@ An open container deployment platform. See README.md for architecture.
 - `agent/` — Go server agent (Podman, Traefik, WireGuard)
 - `cli/` — Go CLI
 - `deployment/` — production Compose files and updater
-- `proxy/`, `registry/`, `logging/` — supporting service configs
+- `proxy/`, `logging/` — supporting service configs
 - `docs/` — documentation
 
 ## Commands

README.md

@@ -15,14 +15,15 @@ A container deployment platform with private-first networking.
 
 ## Tech Stack
 
-| Component | Technology |
-|-----------|------------|
-| Control Plane | Next.js (full-stack) |
-| Database | PostgreSQL + Drizzle |
-| Server Agent | Go |
-| Container Runtime | Podman |
-| Reverse Proxy | Traefik |
-| Private Network | WireGuard |
+| Component             | Technology                          |
+| --------------------- | ----------------------------------- |
+| Control Plane         | Next.js (full-stack)                |
+| Database              | PostgreSQL + Drizzle                |
+| Server Agent          | Go                                  |
+| Container Runtime     | Podman                              |
+| Reverse Proxy         | Traefik                             |
+| Private Network       | WireGuard                           |
+| Source Image Registry | User-owned Google Artifact Registry |
 
 ## How It Works
 
@@ -47,13 +48,17 @@ flowchart LR
 ```
 
 **Traffic Flow:**
+
 - **Public**: Internet → Proxy Node → Traefik (TLS) → WireGuard → Container
 - **Internal**: Container → DNS (.internal) → WireGuard → Container
 
 ## Architecture
 
 See [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) for detailed documentation.
 
+Self-hosted installations require a user-owned Google Artifact Registry Docker
+repository. See the [registry setup guide](docs/infrastructure/registry.mdx).
+
 ## TODO
 
 - Notifications: Alert channels for deployment events and system alerts

compose.dev.yml

@@ -15,24 +15,6 @@ services:
       timeout: 5s
       retries: 5
 
-  registry:
-    build:
-      context: ./registry
-      dockerfile: Dockerfile
-    environment:
-      REGISTRY_USERNAME: docker
-      REGISTRY_PASSWORD: docker
-    ports:
-      - "5002:5000"
-    volumes:
-      - registry-data:/var/lib/registry
-    healthcheck:
-      test: ["CMD", "curl", "-fsS", "http://127.0.0.1:5001/debug/health"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
-    restart: unless-stopped
-
   victoria-logs:
     image: victoriametrics/victoria-logs:v1.51.0
     ports:
@@ -83,7 +65,6 @@ services:
     restart: unless-stopped
 
 volumes:
-  registry-data:
   victoria-logs-data:
   victoria-metrics-data:
   postgres_data:

deployment/.env.example

@@ -29,11 +29,10 @@ VM_USERNAME=admin
 VM_PASSWORD=your-secure-metrics-password
 VM_RETENTION=30d
 
-# Registry
-REGISTRY_URL=registry:5000
-REGISTRY_USERNAME=admin
-REGISTRY_PASSWORD=your-registry-password
-REGISTRY_HTTP_SECRET=your-registry-http-secret
+# Google Artifact Registry (required)
+GAR_REPOSITORY=us-central1-docker.pkg.dev/google-project/techulus-images
+GAR_AGENT_KEY_BASE64=base64-encoded-writer-service-account-json
+GAR_ADMIN_KEY_BASE64=base64-encoded-repository-admin-service-account-json
 
 # Inngest
 INNGEST_SIGNING_KEY=signkey-xxx
@@ -48,7 +47,6 @@ COMPOSE_FILE=compose.production.yml
 # The installer and updater populate immutable release image references.
 # When these image references are omitted, Compose uses TECHULUS_CLOUD_VERSION.
 # TECHULUS_CLOUD_WEB_IMAGE=ghcr.io/techulus/cloud/web@sha256:...
-# TECHULUS_CLOUD_REGISTRY_IMAGE=ghcr.io/techulus/cloud/registry@sha256:...
 # TECHULUS_CLOUD_UPDATER_IMAGE=ghcr.io/techulus/cloud/updater@sha256:...
 CONTROL_PLANE_UPDATER_TOKEN=generate-with-openssl-rand-hex-32
 

deployment/README.md

@@ -2,6 +2,13 @@
 
 Docker Compose setup with Traefik for SSL termination via Let's Encrypt.
 
+A user-owned Google Artifact Registry Docker repository is mandatory. Complete
+the [GAR setup](../docs/infrastructure/registry.mdx), including its two
+repository-scoped service accounts and cleanup policy, before starting Compose.
+The recommended `setup-gar.sh` helper runs from Google Cloud Shell or a trusted
+workstation with an authenticated `gcloud` CLI, not from the control plane or
+production containers.
+
 ## Quick Start
 
 ```bash
@@ -41,23 +48,26 @@ unhealthy containers but does not restart them automatically.
 
 ## Services
 
-| Service | Endpoint |
-|---------|----------|
-| Web | `https://${ROOT_DOMAIN}` |
-| Registry | `https://registry.${ROOT_DOMAIN}` |
-| Logs | `https://logs.${ROOT_DOMAIN}` |
-| PostgreSQL | Internal only |
-| Inngest | Internal only |
+| Service    | Endpoint                      |
+| ---------- | ----------------------------- |
+| Web        | `https://${ROOT_DOMAIN}`      |
+| Logs       | `https://logs.${ROOT_DOMAIN}` |
+| PostgreSQL | Internal only                 |
+| Inngest    | Internal only                 |
 
 ## Environment Setup
 
-Generate registry auth:
-```bash
-htpasswd -nB admin
-# Escape $ as $$ in .env
-```
+Set `GAR_REPOSITORY`, `GAR_AGENT_KEY_BASE64`, and `GAR_ADMIN_KEY_BASE64` in
+`.env`. The installer reads key values without terminal echo. Agents receive
+only the Writer credential; the Repository Administrator key stays in the web
+service.
+
+Upgrades do not migrate images from the former bundled registry. Rebuild every
+source-backed service after upgrading. The old `registry-data` Docker volume is
+left untouched for explicit operator cleanup after the cutover is verified.
 
 Generate Inngest keys:
+
 ```bash
 # Signing key (for request verification)
 openssl rand -hex 32
@@ -68,6 +78,7 @@ openssl rand -hex 16
 ```
 
 Add to `.env`:
+
 ```
 INNGEST_SIGNING_KEY=signkey-prod-<your-signing-key>
 INNGEST_EVENT_KEY=<your-event-key>

deployment/compose.postgres.yml

@@ -82,7 +82,6 @@ services:
       - VICTORIA_LOGS_PRIVATE_URL=http://${VL_USERNAME}:${VL_PASSWORD}@victoria-logs:9428
       - VICTORIA_METRICS_URL=https://${VM_USERNAME}:${VM_PASSWORD}@metrics.${ROOT_DOMAIN}
       - VICTORIA_METRICS_PRIVATE_URL=http://${VM_USERNAME}:${VM_PASSWORD}@victoria-metrics:8428
-      - REGISTRY_HOST=registry.${ROOT_DOMAIN}
       - INNGEST_BASE_URL=http://inngest:8288
       - INNGEST_SIGNING_KEY=${INNGEST_SIGNING_KEY}
       - INNGEST_EVENT_KEY=${INNGEST_EVENT_KEY}
@@ -109,8 +108,9 @@ services:
       - VICTORIA_LOGS_PRIVATE_URL=http://${VL_USERNAME}:${VL_PASSWORD}@victoria-logs:9428
       - VICTORIA_METRICS_URL=https://${VM_USERNAME}:${VM_PASSWORD}@metrics.${ROOT_DOMAIN}
       - VICTORIA_METRICS_PRIVATE_URL=http://${VM_USERNAME}:${VM_PASSWORD}@victoria-metrics:8428
-      - REGISTRY_URL=${REGISTRY_URL:-registry:5000}
-      - REGISTRY_HOST=registry.${ROOT_DOMAIN}
+      - GAR_REPOSITORY=${GAR_REPOSITORY:?GAR_REPOSITORY is required}
+      - GAR_AGENT_KEY_BASE64=${GAR_AGENT_KEY_BASE64:?GAR_AGENT_KEY_BASE64 is required}
+      - GAR_ADMIN_KEY_BASE64=${GAR_ADMIN_KEY_BASE64:?GAR_ADMIN_KEY_BASE64 is required}
       - INNGEST_BASE_URL=http://inngest:8288
       - INNGEST_SIGNING_KEY=${INNGEST_SIGNING_KEY}
       - INNGEST_EVENT_KEY=${INNGEST_EVENT_KEY}
@@ -124,8 +124,6 @@ services:
         condition: service_started
       victoria-metrics:
         condition: service_started
-      registry:
-        condition: service_started
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.web.rule=Host(`${ROOT_DOMAIN}`)"
@@ -162,25 +160,6 @@ services:
       retries: 3
     restart: unless-stopped
 
-  registry:
-    image: "${TECHULUS_CLOUD_REGISTRY_IMAGE:-ghcr.io/techulus/cloud/registry:${TECHULUS_CLOUD_VERSION:?TECHULUS_CLOUD_VERSION is required}}"
-    env_file:
-      - ./.env
-    volumes:
-      - registry-data:/var/lib/registry
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.registry.rule=Host(`registry.${ROOT_DOMAIN}`)"
-      - "traefik.http.routers.registry.entrypoints=websecure"
-      - "traefik.http.routers.registry.tls.certresolver=letsencrypt"
-      - "traefik.http.services.registry.loadbalancer.server.port=5000"
-    healthcheck:
-      test: ["CMD", "curl", "-fsS", "http://127.0.0.1:5001/debug/health"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
-    restart: unless-stopped
-
   victoria-logs:
     image: victoriametrics/victoria-logs:v1.51.0
     env_file:
@@ -257,7 +236,6 @@ services:
 volumes:
   letsencrypt:
   postgres-data:
-  registry-data:
   victoria-logs-data:
   victoria-metrics-data:
   inngest-data:

deployment/compose.production.yml

@@ -64,7 +64,6 @@ services:
       - VICTORIA_LOGS_PRIVATE_URL=http://${VL_USERNAME}:${VL_PASSWORD}@victoria-logs:9428
       - VICTORIA_METRICS_URL=https://${VM_USERNAME}:${VM_PASSWORD}@metrics.${ROOT_DOMAIN}
       - VICTORIA_METRICS_PRIVATE_URL=http://${VM_USERNAME}:${VM_PASSWORD}@victoria-metrics:8428
-      - REGISTRY_HOST=registry.${ROOT_DOMAIN}
       - INNGEST_BASE_URL=http://inngest:8288
       - INNGEST_SIGNING_KEY=${INNGEST_SIGNING_KEY}
       - INNGEST_EVENT_KEY=${INNGEST_EVENT_KEY}
@@ -88,8 +87,9 @@ services:
       - VICTORIA_LOGS_PRIVATE_URL=http://${VL_USERNAME}:${VL_PASSWORD}@victoria-logs:9428
       - VICTORIA_METRICS_URL=https://${VM_USERNAME}:${VM_PASSWORD}@metrics.${ROOT_DOMAIN}
       - VICTORIA_METRICS_PRIVATE_URL=http://${VM_USERNAME}:${VM_PASSWORD}@victoria-metrics:8428
-      - REGISTRY_URL=${REGISTRY_URL:-registry:5000}
-      - REGISTRY_HOST=registry.${ROOT_DOMAIN}
+      - GAR_REPOSITORY=${GAR_REPOSITORY:?GAR_REPOSITORY is required}
+      - GAR_AGENT_KEY_BASE64=${GAR_AGENT_KEY_BASE64:?GAR_AGENT_KEY_BASE64 is required}
+      - GAR_ADMIN_KEY_BASE64=${GAR_ADMIN_KEY_BASE64:?GAR_ADMIN_KEY_BASE64 is required}
       - INNGEST_BASE_URL=http://inngest:8288
       - INNGEST_SIGNING_KEY=${INNGEST_SIGNING_KEY}
       - INNGEST_EVENT_KEY=${INNGEST_EVENT_KEY}
@@ -103,8 +103,6 @@ services:
         condition: service_started
       victoria-metrics:
         condition: service_started
-      registry:
-        condition: service_started
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.web.rule=Host(`${ROOT_DOMAIN}`)"
@@ -141,25 +139,6 @@ services:
       retries: 3
     restart: unless-stopped
 
-  registry:
-    image: "${TECHULUS_CLOUD_REGISTRY_IMAGE:-ghcr.io/techulus/cloud/registry:${TECHULUS_CLOUD_VERSION:?TECHULUS_CLOUD_VERSION is required}}"
-    env_file:
-      - ./.env
-    volumes:
-      - registry-data:/var/lib/registry
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.registry.rule=Host(`registry.${ROOT_DOMAIN}`)"
-      - "traefik.http.routers.registry.entrypoints=websecure"
-      - "traefik.http.routers.registry.tls.certresolver=letsencrypt"
-      - "traefik.http.services.registry.loadbalancer.server.port=5000"
-    healthcheck:
-      test: ["CMD", "curl", "-fsS", "http://127.0.0.1:5001/debug/health"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
-    restart: unless-stopped
-
   victoria-logs:
     image: victoriametrics/victoria-logs:v1.51.0
     env_file:
@@ -235,7 +214,6 @@ services:
 
 volumes:
   letsencrypt:
-  registry-data:
   victoria-logs-data:
   victoria-metrics-data:
   inngest-data:

deployment/gar-cleanup-policy.json

@@ -0,0 +1,31 @@
+[
+  {
+    "name": "keep-techulus-protected",
+    "action": {
+      "type": "Keep"
+    },
+    "condition": {
+      "tagState": "tagged",
+      "tagPrefixes": ["protected-"]
+    }
+  },
+  {
+    "name": "keep-ten-most-recent",
+    "action": {
+      "type": "Keep"
+    },
+    "mostRecentVersions": {
+      "keepCount": 10
+    }
+  },
+  {
+    "name": "delete-unprotected-after-thirty-days",
+    "action": {
+      "type": "Delete"
+    },
+    "condition": {
+      "tagState": "any",
+      "olderThan": "30d"
+    }
+  }
+]